Return Address Falsification Prevention via CPU Debug Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing false code execution due to buffer-overflow vulnerabilities require modifying program code and are ineffective against unknown attack patterns, necessitating frequent system changes and patching, and do not deter false code execution effectively without modifying hardware or software.
Innovation Solution
A method that detects and prevents buffer-overflow attacks by backing up return addresses and using debug functions to detect falsification, producing error signals when the return address is altered, and controlling the program flow to prevent execution of false code, without modifying hardware, operating systems, or software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing methods modify program code to prevent buffer-overflow, then security improvement is achieved, but system complexity and maintenance burden increase
Solution Approach 1:
The patent applies preliminary action by backing up return addresses to a safe location before they are potentially overwritten by buffer-overflow attacks. This preparatory measure ensures that the original return address is preserved and can be restored if corruption is detected, preventing false code execution without requiring complex modifications to the program code itself.
Solution Approach 2:
The patent introduces an intermediary mechanism using the debug function as a mediator between the program execution and the return address storage. The debug function acts as a protective layer that detects modifications to return addresses and triggers appropriate responses, thereby securing the system without directly modifying the core program code.
2Reliability
If existing methods use signature-based virus detection, then known threats can be identified, but unknown attack patterns remain undetected
Solution Approach 1:
The patent implements feedback by continuously monitoring return addresses during program execution and comparing them against the backed-up original values. When a discrepancy is detected, the system immediately responds by terminating the program or alerting the user. This active feedback mechanism enables detection of unknown attack patterns in real-time, rather than relying on pre-programmed signatures.
Solution Approach 2:
The patent applies self-service by enabling the system to detect and respond to buffer-overflow attacks autonomously through the debug function. The system monitors its own execution state, detects modifications to critical data structures like return addresses, and takes corrective action without external intervention, thereby adapting to any attack pattern that modifies memory structures.
3Reliability
If frequent system changes and patching are performed to address security vulnerabilities, then security is maintained, but time loss and productivity decrease
Solution Approach 1:
The patent applies preliminary action by implementing permanent protective measures through the debug function that automatically detects and responds to buffer-overflow attacks. This eliminates the need for frequent patches and system changes, as the protection is built into the execution environment and activates only when needed, thereby reducing time loss and maintaining productivity.
4Reliability
If return address is protected by making it read-only, then false code execution is prevented, but program functionality may be impaired
Solution Approach 1:
The patent applies preliminary action by backing up the return address to a safe location before execution begins. This allows the return address to be read and modified during normal program operation without compromising security. The backup serves as a safety net that can be restored if corruption is detected, thereby maintaining both protection and functionality.
Solution Approach 2:
The patent introduces the debug function as an intermediary that mediates between the read-only protection requirement and the need for program functionality. The debug function monitors access to return addresses and only intervenes when corruption is detected, allowing normal operation to proceed uninterrupted while maintaining security through the backup mechanism.
Data Source
AI summary
A method for preventing a return address from being falsified due to a buffer overflow during the program execution, and for detecting the buffer-overflow beforehand.When the return address is re-written during program execution, the debug function of the central processing unit is used to output an error. The falsification of the return address is detected through the error output. Then the falsified return address is re-written to a value stored in advance to enable the program to return to normal operation. When the falsification of the return address is detected, the executing program is terminated.